CVE-2026-111090: Improper Signature Verification of Firmware Update Files
A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automatic verification via SNS.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Retrieve update files and licenses only from MyStormshield servers, or use automatic verification via SNS.
Event History
Frequently Asked Questions
Who is exposed to this issue?
SNS deployments that retrieve firmware update or license files from sources other than MyStormshield servers, or that do not use automatic verification via SNS, are exposed to acceptance of unauthenticated files.
What does an attacker need to exploit the issue?
The attacker would need to cause an unauthenticated firmware update or license file to be used by the affected SNS system. The provided data does not identify a required authenticated account or network access path.
What can be done if a fix is not immediately available?
Retrieve update files and licenses only from MyStormshield servers, or use SNS automatic verification. Avoid using update or license files obtained from other sources.